90 lines
2.3 KiB
YAML
90 lines
2.3 KiB
YAML
---
|
|
- name: Configure environment
|
|
hosts: all
|
|
tasks:
|
|
- name: Set hostname
|
|
become: true
|
|
hostname:
|
|
name: "{{ ansible_host }}"
|
|
|
|
- import_tasks: tasks/sshd/banner.yml
|
|
|
|
- name: Install global bash components
|
|
become: true
|
|
copy:
|
|
src: bash/{{ item }}.sh
|
|
dest: /etc/profile.d/Z-{{ 10 + loop_index }}-enpn-{{ item }}.sh
|
|
mode: 0644
|
|
loop:
|
|
- global
|
|
- pyenv
|
|
- aliases
|
|
- helpers
|
|
loop_control:
|
|
index_var: loop_index
|
|
label: "{{ item }}"
|
|
|
|
- name: Disable dynamic MOTD
|
|
become: true
|
|
replace:
|
|
path: /etc/pam.d/sshd
|
|
regexp: "^session\\s+optional\\s+pam_motd\\.so.*$"
|
|
replace: "#session optional pam_motd.so"
|
|
|
|
- name: Remove legacy global bashrc
|
|
become: true
|
|
file:
|
|
path: /etc/profile.d/ZA-enpn-bashrc.sh
|
|
state: absent
|
|
|
|
- name: Disable case-sensitive autocomplete
|
|
become: true
|
|
lineinfile:
|
|
path: /etc/inputrc
|
|
line: set completion-ignore-case ((o|O)(n|ff))
|
|
create: true
|
|
mode: 0644
|
|
|
|
- name: Configure additional security settings on shared servers
|
|
hosts: servers
|
|
tasks:
|
|
- name: Identify local home directories
|
|
become: true
|
|
find:
|
|
file_type: directory
|
|
path: /home/
|
|
recurse: false
|
|
register: _local_home_dirs
|
|
|
|
- name: Determine files to write-protect
|
|
set_fact:
|
|
_secure_files: >-
|
|
{{ _secure_files | default([]) + [
|
|
item.path ~ '/.bashrc',
|
|
item.path ~ '/.bash_profile',
|
|
item.path ~ '/.ssh/authorized_keys',
|
|
item.path ~ '/.ssh/config'
|
|
] }}
|
|
loop: "{{ _local_home_dirs.files }}"
|
|
loop_control:
|
|
label: "{{ item.path }}"
|
|
|
|
- name: Fetch status of secure files
|
|
become: true
|
|
stat:
|
|
path: "{{ item }}"
|
|
loop: "{{ _secure_files }}"
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
register: _secure_file_stats
|
|
|
|
- name: Restrict access to secure files
|
|
become: true
|
|
file:
|
|
path: "{{ item.item }}"
|
|
state: "{{ 'file' if item.stat.exists else 'touch' }}"
|
|
mode: 0400
|
|
loop: "{{ _secure_file_stats.results }}"
|
|
loop_control:
|
|
label: "Write-protecting: {{ item.item }}"
|